Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] pcap_breakloop and MacOSX

From: Sebastien Tandel <sebastien@xxxxxxxxx>
Date: Sun, 22 Apr 2007 15:34:12 +0200
>> The configure script outputs the following warning in the case the
>> library is more recent than the header :
>>
>> checking whether pcap library is more recent than pcap header... yes
>>     
>
> I.e., this would replace the existing check?  If so, I'd check both  
> pcap_breakloop() and pcap_findalldevs() in that test, so that if the  
> test succeeds, you know both of those functions are usable.
>   
It's not so easy as - at least on my Debian - pcap_if_t is defined in
libpcap 0.7.2 header but pcap_breakloop is not.
I don't know if it's a specific debian change but at least, for this
reason, they have to be tested separately.

>> configure: WARNING:
>> Your pcap library is more recent than your pcap header. Wireshark  
>> won't
>> be compiled with functions not defined in this header. It would be  
>> therefore
>> better to install the newer pcap header.
>>     
>
> I suspect a lot of people won't see warnings such as that (I probably  
> wouldn't), but it's still worth printing it.
>
> I might have it say
>
> 	Your pcap library is more recent than your pcap header file.  
> Wireshark won't
> 	be able to use functions not declared in that header. You should  
> install a newer
> 	version of the header file.
>
> and perhaps do a check to see if it's running on OS X 10.3 and, if so,  
> specifically suggest that they use the libpcap 0.8.3 header.  (On most  
> other OSes either
>
> 	1) libpcap comes with the OS, but any update would probably update  
> the headers
>
> or
>
> 	2) libpcap doesn't come with the OS, so it was installed from source,  
> and the library and headers would probably match
>
> so OS X 10.3 is probably the only place you'd see this.)
>   

In fact, you can have this issue on any platforms which might have
multiple libpcap versions coexisting. On Debian, you can have (in a
coherent state of course), the pcap header for the version 0.7 along
with the library /and/ also the pcap library version 0.8. But everyone
in this situation may redirect libpcap.so towards libpcap.so.0.8. I know
it's completely silly and should be the most rare case but I've already
seen a FAQ guide for a "home bank" security module telling the user to
do something similar! :)



Regards,
Sebastien Tandel